01
Data protection & privacy
Lawful basis, notices, data-handling controls, and vendor terms for AI use involving personal or regulated data.
The Compliance Readiness Assessment determines whether you can demonstrate, with evidence, that your AI use meets your regulatory, contractual, and ethical obligations. The emphasis is on demonstrability: regulators, customers, and courts increasingly require organizations to show their work, and an obligation you meet in practice but cannot evidence is a compliance gap.
Compliance is assessed across the obligation categories relevant to your sector and jurisdictions. We map each in-scope AI use to its applicable obligations and test whether you can produce the evidence.
Lawful basis, notices, data-handling controls, and vendor terms for AI use involving personal or regulated data.
Industry obligations such as fairness and adverse-action requirements where AI informs employment, credit, insurance, or healthcare decisions.
Emerging obligations around transparency, human oversight, risk classification, documentation, and disclosure of automated decision-making.
Commitments to customers and partners on data use, confidentiality, and AI, including whether AI use is permitted under existing agreements.
Whether AI use creates IP ownership ambiguity or risks disclosing confidential or trade-secret information to third parties.
Whether you retain the records needed to reconstruct and defend an AI-assisted decision after the fact.
The test is not whether something exists in principle but whether you could produce a credible, evidenced account on demand.
We identify the obligations applicable to your organization and map each to the specific AI uses it touches, producing an obligations-to-use matrix.
For each mapped obligation we request the evidence that would demonstrate compliance and evaluate its sufficiency. Missing or thin evidence is recorded as a readiness gap.
Higher-risk uses receive a walkthrough in which we trace a real decision end to end to confirm controls operate as documented.
Each obligation area is rated on a simple test: if challenged tomorrow, could you produce a credible, evidenced account of compliance?
Critical findings, those representing live legal or regulatory exposure, are escalated immediately rather than held for the final report.
A short conversation about your regulated AI uses, your obligations, and what a focused readiness assessment would cover.